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[Title of the Invention] Quantum key distribution method and 

communication apparatus 

[Scope of Claims for Patent] 
5 [Claim 1] A quantum key distribution method employed on a 

quantum cryptosystem including a first communication apparatus that 

transmits photons onto a quantum communication path and a second 

communication apparatus that measures the photons, comprising: 

a check matrix creation step of each of the first communication 
10 apparatus and the second communication apparatus creating the same 

parity check matrices H(nxk); 

a random number generation step of the first communication 

apparatus generating a random number sequence (transmission data) 

and randomly determining a predetermined transmission code (base) 
15 by the first communication apparatus, and the second communication 

apparatus randomly determining a predetermined reception code 

(base); 

a photon transmission step of the first communication apparatus 
transmitting a photon onto the quantum communication path while the 
20 photon is in a quantum state specified by a combination of the 
transmission data and the transmission code; 

a photon reception step of the second communication apparatus 
measuring the photon transmitted on the quantum communication path 
to obtain reception data specified by the combination of the reception 
25 code and measurement result; 
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a data deletion step of each of the first communication 
apparatus and the second communication apparatus deciding whether 
the measuring has been performed with an appropriate measuring 
apparatus, saving the reception data of n bits if the measuring has been 
5 performed with the appropriate measuring apparatus and transmission 
data that corresponds to the reception data, and discarding other 
pieces of the data; 

an error correction information notification step of the first 
communication apparatus notifying the second communication 
10 apparatus through a public communication path of error correction 
information of k bits based on the parity check matrix H and the 
transmission data of n bits; 

an error correction step of the second communication apparatus 
correcting the error of the reception data based on the parity check 
15 matrix H, the reception data of n bits, and the error correction 
information; and 

a cryptographic key creation step of each of the first 
communication apparatus and the second communication apparatus 
discarding a part (k) of pieces of the common information (n) after 
20 correction according to public error correction information, creating a 
cryptographic key using information that has remained after discarding, 
and setting the cryptographic key as a common key which is shared 
between apparatuses. 

[Claim 2] The quantum key distribution method according to 
25 claim 1 , wherein the check matrix creation step includes 
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weight searching step of using finite affine geometry as a basic 
matrix and searching optimum row and column weight distributions of 
the parity check matrix by performing optimization of Gaussian 
approximation, 

5 dividing step of dividing randomly the row and column weights 

of the finite affine geometry based on the optimum weight distribution 
by a predetermined procedure, and creating the parity check matrix H 
of a low-density parity check code in which both the row and column 
weights or one of the row and column weights is not uniform. 

10 [Claim 3] The quantum key distribution method according to 

claim 1 or 2, wherein the check matrix creation step includes creating 
an inverse matrix G" 1 (nx(n-k)), which satisfies G" 1 G=I (unit matrix), 
from a creation matrix G((n-k)xn) satisfying "HG=0," and 

the cryptographic key creation step includes discarding a part 

15 (k) of pieces of the common information (n) by the inverse matrix G" 1 . 

[Claim 4] The quantum key distribution method according to 
claim 1 or 2, wherein the check matrix creation step includes creating a 
mapping F to map an n-dimensional vector to an m-dimensional vector 
(m<n-k), the mapping F being one in which the number of elements of a 

20 reverse image (F-G)" 1 (v) in a composition mapping F G of the mapping 
F and the creation matrix G satisfying "HG=0" is independent of an 
arbitrary m-dimensional vector v and is constant(2 n " k " m ), and 

the cryptographic key creation step includes discarding a part of 
pieces of the common information (n) by the mapping F. 

25 [Claim 5] The quantum key distribution method according to 
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claim 2, wherein the cryptographic key creation step includes 
performing random permutation to the column of the parity check matrix 
H, selecting specific "1" in the first column of finite affine geometry 
AG(2,2 S ) of a creation element of the parity check matrix H, exchanges 
5 a position of "1" through a public communication path, specifying the 
position (column) after the division corresponding to "1" from the parity 
check matrix after the random permutation and the position (column) 
after the division corresponding to "1" in each cyclically shifted column, 
and discarding a part (k) of pieces of the common information (n) 
10 corresponding to the specified position (column). 

[Claim 6] The quantum key distribution method according to 
claim 3, 4 or 5, wherein the cryptographic key creation step includes 

one of the communication apparatus, out of the first 
communication apparatus and the second communication apparatus, 
15 creating a nonsingular random matrix R((n-k)x(n-k)) to act on the 
cryptographic key after discarding a part (k) of pieces of the common 
information (n) and informing the nonsingular random matrix R to other 
one of the communication apparatuses through a public communication 
path, 

20 the first communication apparatus and the second 

communication apparatus using the nonsingular random matrix R to 
create the cryptographic key. 

[Claim 7] A communication apparatus on transmission side that 
transmits photons onto a quantum communication path, comprising: 

25 a check matrix creation unit that creates a parity check matrix 
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H(nxk) identical to a communication apparatus on reception side; 

a transmission unit that generates a random number sequence 
(transmission data), randomly determines a predetermined transmission 
code (base), transmits the photon onto the quantum communication 
5 path while the photon is in a quantum state specified by a combination 
of the transmission data and the transmission code, decides whether 
the measuring has been performed with an appropriate measuring 
apparatus in the communication apparatus on the reception side, saves 
the transmission data of n bits if the measuring has been performed 
10 with the appropriate measuring apparatus, and discards other pieces of 
the transmission data; 

an error correction information notifying unit that notifies the 
communication apparatus on the reception side of error correction 
information of k bits based on the parity check matrix H and the 
15 transmission data of n bits through a public communication path; and 

a cryptographic key creation unit that discards a part (k) of 
pieces of the common information (n) after error correction according to 
public error correction information, creates a cryptographic key using 
information that has remained after discarding, and sets the 
20 cryptographic key as a common key which is shared with the 
communication apparatus on the reception side. 

[Claim 8] A communication apparatus on reception side that 
measures photons on a quantum communication path, comprising: 

a check matrix creation unit that creates a parity check matrix 
25 H(nxk) identical to a communication apparatus on transmission side; 
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a receiving unit that randomly determines a predetermined 
reception code (base), measures the photons on the quantum 
communication path, reproduces reception data specified by a 
combination of the reception code and measurement result, decides 
5 whether the measuring has been performed with an appropriate 
measuring apparatus, saves the reception data of n bits if the 
measuring has been performed with the appropriate measuring 
apparatus, and discards other pieces of the reception data; 

an error correction unit that corrects the error of reception data 
10 based on error correction information of k bits received through a public 
communication path, the parity check matrix H, and the reception data 
of n bits; and 

a cryptographic key creation unit that discards a part (k) of 
pieces of the common information (n) after error correction according to 
15 public error correction information, creates a cryptographic key using 
information that has remained after discarding, and sets the 
cryptographic key as a common key which is shared with the 
communication apparatus on the transmission side. 

[Claim 9] The communication apparatus according to claim 7 
20 or 8, wherein the check matrix creation unit uses finite affine geometry 
as a basic matrix, searches optimum row and column weight 
distributions of the parity check matrix by performing optimization of 
Gaussian approximation, 

divides randomly the row and column weights of the finite affine 
25 geometry based on the optimum weight distribution by a predetermined 
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procedure, and 

creates the parity check matrix H of a low-density parity check 
code in which both the row and column weights or one of the row and 
column weights is not uniform. 
5 [Claim 10] The communication apparatus according to claim 7, 

8 or 9, wherein the check matrix creation unit further creates an inverse 
matrix G" 1 (nx(n-k)), which satisfies G" 1 G=I (unit matrix), from a creation 
matrix G((n-k)xn) satisfying "HG=0," and 

the cryptographic key creation unit discards a part (k) of pieces 
10 of the common information (n) by the inverse matrix G" 1 . 

[Claim 11] The communication apparatus according to claim 7, 
8 or 9, wherein the check matrix creation unit further creates a mapping 
F to map an n-dimensional vector to an m-dimensional vector (m<n-k), 
the mapping F being one in which the number of elements of a reverse 
15 image (F-G)" 1 (v) in a composition mapping FG of the mapping F and 
the creation matrix G satisfying "HG-0" is independent of an arbitrary 
m-dimensional vector v and is constant(2 n " k " m ), and 

the cryptographic key creation unit discards a part of pieces of 
the common information (n) by the mapping F. 
20 [Claim 12] The communication apparatus according to claim 9, 

wherein the cryptographic key creation unit performs random 
permutation to the column of the parity check matrix H, selects specific 
"1" in the first column of finite affine geometry AG(2, 2 s ) of a creation 
element of the parity check matrix H, exchanges a position of "1" 
25 through a public communication path, specifies the position (column) 
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after the division corresponding to "1" from the parity check matrix after 
the random permutation and the position (column) after the division 
corresponding to "1" in each cyclically shifted column, and discards a 
part (k) of pieces of the common information (n) corresponding to the 
5 specified position (column). 

[Claim 13] The communication apparatus according to claim 
10, 11 or 12, wherein the cryptographic key creation unit uses a 
nonsingular random matrix R((n-k)x(n-k)) as the cryptographic key after 
discarding a part (k) of pieces of the common information (n). 
10 [Detailed Description of the Invention] 

[0001] 

[Field of the Invention] 

The present invention relates to a quantum key distribution 
method with which it is possible to create a highly-secured common key, 
15 and particularly to the quantum key distribution method with which it is 
possible correct data error by an error correction code, and to a 
communication apparatus that can realize the quantum key distribution. 

[0002] 

[Prior Art] 

20 A conventional quantum cryptosystem is described below. 

Recently, optical communications, which allow high-speed, 
large-capacity communication, have been widely used. In such an 
optical communication system, the communication is performed by 
turning a light beam on and off. When the light beam is turned on, a 

25 large quantity of photons are transmitted, so that such optical 



communication system does not directly produce the quantum effect. 
[0003] 

On the other hand, in the quantum cryptosystem, the photon is 
used as a communication medium, and information of one bit is 
5 transmitted by one photon so that the quantum effect such as the 
uncertainty principle is generated. If a person who wants to tap the 
communication (hereinafter, "interceptor") randomly selects a base to 
measure the photon without knowing a quantum state such as a phase, 
the quantum state is changes. Therefore, on a receiver side, it is 
10 possible to recognize whether transmission data is intercepted by 
confirming the change in quantum state of the photon. 

[0004] 

Fig. 9 is an overview of a conventional quantum key distribution 
utilizing polarization. For example, a measuring apparatus, which can 

15 identify the light polarized in a horizontal direction from the light 

polarized in a vertical direction, correctly identifies the light polarized in 
the horizontal direction (0°) on a quantum communication path from the 
light polarized in the vertical direction (90°) on the quantum 
communication path. On the other hand, another measuring apparatus, 

20 which can identify the light polarized in an oblique direction (45°, 135°), 
correctly identifies the light polarized in the oblique direction of 45° on a 
quantum communication path from the light polarized in the oblique 
direction of 135° on the quantum communication path. 
[0005] 

25 As described above, each measuring apparatus can correctly 



recognize the light polarized in the specified direction. However, when 
the light polarized in the oblique direction is measured with the 
measuring apparatus that can identify the light polarized in the 
horizontal direction from the light polarized in the vertical direction, the 
5 apparatus recognizes the light polarized in the horizontal direction (0°) 
and the light polarized in the vertical direction (90°) with the probability 
of 50% respectively. Namely, when a measuring apparatus that does 
not match the identifiable polarized direction is used, even if the 
measurement result is analyzed, the polarized direction cannot be 
10 correctly identified. 
[0006] 

In the quantum key distribution shown in Fig. 9, by utilizing the 
uncertainty (randomness), a person who transmits the data (transmitter) 
and a person who receives the data (receiver) share a key without 
15 being known by the interceptor (Patent Literature 1). The transmitter 
and the receiver can also use a public communication path in addition 
to the quantum communication path. A procedure of sharing the key is 
described. 

[0007] 

20 The transmitter first generates a random number sequence 

(sequence of 1 and 0: transmission data) and randomly chooses a 
transmission code (+: the code corresponding to the measuring 
apparatus that can identify the light polarized in the horizontal direction 
from the light polarized in the vertical direction, and x: the code 

25 corresponding to the measuring apparatus that can identify the light 



10 



polarized in the oblique direction). The combination of the random 
number sequence and the transmission code can automatically set the 
polarized direction of the transmitted light. In this case, the light 
polarized in the horizontal direction by the combination of 0 and +, the 
5 light polarized in the vertical direction by the combination of 1 and +, 
the light polarized in the 45° direction by the combination of 0 and x, 
and the light polarized in the 135° direction by the combination of 1 and 
x are transmitted to the quantum communication path (transmission 
signal). 

10 [0008] 

The receiver randomly chooses a reception code (+: the code 
corresponding to the measuring apparatus that can identify the light 
polarized in the horizontal direction from the light polarized in the 
vertical direction, and x: the code corresponding to the measuring 

15 apparatus that can identify the light polarized in the oblique direction) 
and measures the light on the quantum communication path (reception 
signal). The receiver obtains reception data by the combination of the 
reception code and the reception signal. In this case, 0 is obtained as 
the reception data by the combination of the light polarized in the 

20 horizontal direction and +, 1 is obtained as the reception data by the 
combination of the light polarized in the vertical direction and +, 0 is 
obtained as the reception data by the combination of the light polarized 
in the 45° direction and x, and 0 is obtained as the reception data by 
the combination of the light polarized in the 135° direction and x. 

25 [0009] 
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The receiver then transmits the reception code to the transmitter 
through the public communication path in order to check whether the 
receiver has performed a measurement with an appropriate measuring 
apparatus. Having received the reception code, the transmitter checks 
5 whether the measurement of the receiver has been performed with an 
appropriate measuring apparatus. The transmitter transmits the result 
to the receiver through the public communication path. 
[0010] 

The receiver then saves (keeps behind) only the reception data 
10 corresponding to the reception signal which is received with the 
appropriate measuring apparatus, and discards other pieces of the 
reception data. At this point, the transmitter and the receiver can 
securely share the saved reception data. 
[0011] 

15 The transmitter and the receiver then transmit the 

predetermined number of pieces of data selected from the common 
data to each other through the public communication path. The 
transmitter and the receiver confirm whether the received data 
corresponds to the data owned by oneself. For example, when even 

20 one piece of the confirmed data does not correspond to the data owned 
by the transmitter or the receiver, judging that the interceptor is present, 
they discard the common data and perform the process of sharing the 
key again from the start. On the other hand, when the confirmed data 
completely corresponds to the data owned by the transmitter or the 

25 receiver, judging that there is no interceptor, the transmitter and the 
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receiver discard the data used for the confirmation, and the saved 
common data becomes the common key for the transmitter and the 
receiver. 

[0012] 

5 Application of the conventional quantum key distribution method 

includes the quantum key distribution method that can correct data 
error on a transmission path. 
[0013] 

In the method, in order to detect the data error, the transmitter 
10 divides the transmission data into a plurality of blocks and transmits 
parity in each block onto the public communication path. The receiver 
compares the parity in each block received through the public 
communication path, to the parity of the corresponding block in the 
reception data and checks the data error. When a different parity is 
15 present, the receiver transmits a reply of the information indicating 

which parity of the block is different onto the public communication path. 
The transmitter further divides the appropriate block into a first half 
block and a second half block and transmits, for example, the first half 
parity onto the public communication path (binary search). The 
20 transmitter and the receiver then specify a position of an error bit by 
repeating the binary search, and the receiver finally corrects the 
specified bit. 
[0014] 

Assuming that it is determined that a parity is correct due to 
25 even number of errors even if an error is present in the data, the 
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transmitter randomly permutates the transmission data (random 
permutation) to divide the transmission data into a plurality of blocks 
and performs the error correction processing by the binary search again. 
All the data errors are corrected by repeatedly executing the error 
5 correction processing by the random permutation. 
[0015] 

[Patent Literature 1] 
Bennett. C. H. and Brassard, G.: Quantum Cryptography: Public 
Key Distribution and Coin Tossing, In Proceedings of IEEE Conference 
10 on Computers, System and Signal Processing, Bangalore, India, pp. 
175-179 (DEC. 1984). 

[Patent Literature 2] 
Brassard, G. and Salvail, L. 1993 Secret-Key Reconciliation by 
Public Discussion, In Advances in Cryptology - EUROCRYPT '93, 
15 Lecture Notes in Computer Science 765, 410-423. 
[0016] 

[Problems to be Solved by the Invention] 

In the conventional quantum key distribution shown in Fig. 9, 
however, an error communication path is not considered. When an 
20 error is present, the common data (common key) is discarded because 
an intercepting action is presumed to be present. Therefore, there is a 
problem that creation efficiency of the common key is correspondingly 
affected in some transmission paths. 

[0017] 

25 In the quantum key distribution method that can correct the data 
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error on the transmission path, huge number of exchanges of the parity 
is generated for specifying the error bit, and the error correction 
processing is also performed in a predetermined times by the random 
permutation. Therefore, there is a problem that a long period of time is 
5 required for the error correction processing. 
[0018] 

It is an object of the present invention to provide a quantum key 
distribution method that can create a highly-secured common key while 
correcting data error on a transmission path by an error correction code 
10 having remarkably high characteristics. 
[0019] 

[Means to Solve the Problems] 

In order to solve the above problems and achieve the object, a 
quantum key distribution method according to the present invention is 

15 employed on a quantum cryptosystem including a first communication 
apparatus that transmits photons onto a quantum communication path 
and a second communication apparatus that measures the photons. 
The method includes, for example, a check matrix creation step of each 
of the first communication apparatus and the second communication 

20 apparatus creating the same parity check matrices H(nxk); a random 
number generation step of the first communication apparatus 
generating a random number sequence (transmission data) and 
randomly determining a predetermined transmission code (base) by the 
first communication apparatus, and the second communication 

25 apparatus randomly determining a predetermined reception code 
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(base); a photon transmission step of the first communication apparatus 
transmitting a photon onto the quantum communication path while the 
photon is in a quantum state specified by a combination of the 
transmission data and the transmission code; a photon reception step 
5 of the second communication apparatus measuring the photon 
transmitted on the quantum communication path to obtain reception 
data specified by the combination of the reception code and 
measurement result; a data deletion step of each of the first 
communication apparatus and the second communication apparatus 

10 deciding whether the measuring has been performed with an 

appropriate measuring apparatus, saving the reception data of n bits if 
the measuring has been performed with the appropriate measuring 
apparatus and transmission data that corresponds to the reception data, 
and discarding other pieces of the data; an error correction information 

15 notification step of the first communication apparatus notifying the 

second communication apparatus through a public communication path 
of error correction information of k bits based on the parity check matrix 
H and the transmission data of n bits; an error correction step of the 
second communication apparatus correcting the error of the reception 

20 data based on the parity check matrix H, the reception data of n bits, 
and the error correction information; and a cryptographic key creation 
step of each of the first communication apparatus and the second 
communication apparatus discarding a part (k) of pieces of the common 
information (n) after correction according to public error correction 

25 information, creating a cryptographic key using information that has 
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remained after discarding, and setting the cryptographic key as a 
common key which is shared between apparatuses. 
[0020] 

According to the invention, the data error of the common 
5 information is corrected by a deterministic and stable-characteristics 
parity check matrix for "Irregular-LDPC code", and a part of the 
common information is discarded depending on the public error 
correction information. 
[0021] 

10 [Embodiments of the Invention] 

Exemplary embodiments of a quantum key distribution method 
according to the present invention are described with reference to the 
accompanying drawings. It should be noted that the invention is not 
limited to the exemplary embodiments. Although a quantum key 

15 distribution utilizing a polarized light is described below as an example, 
the invention can be also applied to the quantum key distribution 
utilizing a phase, the quantum key distribution utilizing a frequency, and 
the like, and the invention does not particularly limit what quantum state 
is utilized. 

20 [0022] 

First Embodiment 

The quantum key distribution is a key distribution method, which 
is security-guaranteed regardless of computational ability of 
interceptors. However, for example, in order to create a common key 

25 more efficiently, it is necessary to remove the data error generated 
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when the data passes through the transmission path. Therefore, the 
quantum key distribution which performs the error correction by a 
Low-Density Parity-Check (LDPC) code is described in this embodiment. 
It is known that the LDPC code has remarkably high characteristics. 
5 [0023] 

Fig. 1 depicts a configuration of the communication apparatus 
(transmission device and receiving device) in the quantum 
cryptosystem according to the first embodiment of the invention. The 
quantum cryptosystem includes the communication apparatus on the 
10 transmission side having a function of transmitting information m a and 
the communication apparatus on the reception side having the function 
of receiving information m a which is affected by a noise or the like on 
the transmission path, i.e. information m b . 

[0024] 

15 The communication apparatus on the transmission side includes 

a cryptographic key creation unit 1 and a communication unit 2. The 
cryptographic key creation unit 1 transmits the information m a through 
the quantum communication path, transmits a syndrome Sa through the 
public communication path, and creates a cryptographic key (common 

20 key with the reception side) based on the information m a and the 
syndrome Sa. In the communication unit 2, an encryption unit 21 
encrypts the data based on the cryptographic key and a transmission 
and receiving unit 22 exchanges the data through the public 
communication path. The communication apparatus on the reception 

25 side includes a cryptographic key creation unit 3 and a communication 
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unit 4. The cryptographic key creation unit 3 receives the information 
nib through the quantum communication path, receives the syndrome 
Sa through the public communication path, and creates the 
cryptographic key (common key with the transmission side) based on 
5 the information rrib and the syndrome Sa. In the communication unit 4, 
an encryption unit 42 encrypts the data based on the cryptographic key 
and a transmission and receiving unit 41 exchanges the data through 
the public communication path. 
[0025] 

10 In the communication apparatus on the transmission side, the 

light polarized in the predetermined direction with a polarization filter 
(see Fig. 9) is transmitted as the information m b transmitted onto the 
quantum communication path to the communication apparatus on the 
reception side. On the other hand, in the communication apparatus on 

15 the reception side, the light polarized in the horizontal direction (0°) on 
the quantum communication path, the light polarized in the vertical 
direction (90°) on the quantum communication path, the light polarized 
in the oblique direction of 45° on the quantum communication path, and 
the light polarized in the oblique direction of 135° on the quantum 

20 communication path are identified by the measuring apparatus that can 
identify the light polarized in the horizontal direction (0°) from the light 
polarized in the vertical direction (90°) and the measuring apparatus 
that can identify the light polarized in the oblique direction (45°) from 
the light polarized in the oblique direction (135°). Each measuring 

25 apparatus can correctly recognize the light which is polarized in the 
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specified direction. However, when the light polarized in the oblique 
direction is measured with the measuring apparatus that can identify 
the light polarized in the horizontal direction (0°) from the light polarized 
in the vertical direction (90°), the measuring apparatus recognizes the 
5 light polarized in the horizontal direction and the light polarized in the 
vertical direction with the probability of 50% respectively. Namely, 
when the measuring apparatus that does not match the identifiable 
polarized direction is used, even if the measurement result is analyzed, 
the polarized direction cannot be correctly identified. 

10 [0026] 

The operation of each communication apparatus in the quantum 
cryptosystem, i.e., the quantum key distribution according to the 
embodiment is described in detail below. Fig. 2 is a flowchart of a 
process procedure for the quantum key distribution according to the 

15 first embodiment, particularly Fig. 2(a) depicts a process procedure 
performed by the communication apparatus on the transmission side 
and Fig. 2(b) depicts a process procedure performed by the 
communication apparatus on the reception side. 
[0027] 

20 In the communication apparatus on the transmission side and 

the communication apparatus on the reception side, parity check matrix 
creation units 10 and 30 obtain a parity check matrix H(nxk) of a 
specific linear code, a creation matrix G((n-k)xn) satisfying "HG=0" from 
the parity check matrix H, and an inverse matrix G" 1 (nx(n-k)) of the 

25 creation matrix G, and further obtain the inverse matrix G" 1 satisfying 
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G" 1 G=I (unit matrix) (step S1 and step S11). The quantum key 
distribution of an instance that the LDPC code having the excellent 
characteristics extremely close to Shannon limit is used as the specific 
linear code is described in this embodiment. The LDPC code is used 
5 as the error correction method in this embodiment. This embodiment 
is not limited to the LDPC code, and it is also possible to use other 
linear codes such as a turbo code. Further, as long as error correction 
information (syndrome) described later is an error correction protocol 
expressed by a product Hm A of a proper matrix H and information m A 

10 (for example, the error correction protocol corresponding to "the 
quantum key distribution which can correct the data error on the 
transmission path" described in the Background art), namely as long as 
the linearity of the error correction information and the linearity of the 
information m A are secured, the matrix H may be used as the specific 

15 linear code. 

[0028] 

A method of forming the LDPC code in the parity check matrix 
creation unit 10, particularly the method of forming an "Irregular-LDPC 
code" based on affine finite geometry (Details of step S1 in Fig. 2) is 

20 described. The description of the parity check matrix creation unit 30 
is omitted because the operation of the parity check matrix creation unit 
30 is identical as the parity check matrix creation unit 10. In this 
embodiment, check matrix creation processing may be configured to be 
performed according to a set parameter by the parity check matrix 

25 creation unit 10, or the check matrix creation processing may be 
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configured to be performed by other control units (such as a computer) 
outside the communication apparatus. When the check matrix creation 
processing in this embodiment is performed outside the communication 
apparatus, the already created check matrix is stored in the 
5 communication apparatus. An instance of the above processing being 
performed by the parity check matrix creation unit 10 is described below. 
[0029] 

The parity check matrix creation unit 10 selects a finite affine 
geometry code AG(2,2 S ) which becomes a base of the check matrix for 
10 "Irregular-LDPC code" (Fig. 3, step S21). In this case, a weight of a 
row and the weight of a column become 2 s , respectively. Fig. 4 
depicts, for example, the matrix of the finite affine geometry code AG (2, 
2 2 ) (a blank in the matrix indicates 0). 

[0030] 

15 The parity check matrix creation unit 10 then determines a 

maximum value (2<r^2 s ) of the weight of the column (step S22). 
The parity check matrix creation unit 10 also determines a coding rate 
(1 -syndrome length/key length) (step S22). 
[0031] 

20 The parity check matrix creation unit 10 then uses optimization 

of Gaussian approximation and tentatively determines a weight 
distribution of the column and a weight distribution of the row p u 
(step S23). A creation function p(x) of the weight distribution of the 
row is set to p(x) = p u x u1 +(1-p u )x u . A weight u is an integer of u>2, 

25 and p u indicates a portion of the weight u in the row. 
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[0032] 

The parity check matrix creation unit 10 selects the weight of 
the row {u, u+1} which can be formed by dividing the row of the finite 
affine geometry, and determines a division coefficient {b u , bu +1 } which 
5 satisfies the following equation (1), where b u and b u+1 are a 
non-negative integer (step S24). 

b u +b u+ i(u+1)=2 s (1) 

[0033] 

Specifically, b u +i is determined from the equation (1) after 
10 determining b u from. 
[0034] 
[Formula 1] 

■ I Uxb u I 

arg-min cp u - ^ s u (2) 
[0035] 

15 The parity check matrix creation unit 10 then determines the 

weight distributions p u ' and p u+1 ' of the row updated by the determined 
parameters u, u+1, b u , and b u +i (by the row division processing 
mentioned above) from (step S25). 
[0036] 
20 [Formula 2] 

, uxb 

(3) 

(u + 1)xb u+1 v ' 

^ T 

[0037] 
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The parity check matrix creation unit 10 then uses the 
optimization of Gaussian approximation, sets u, u+1, p u ', and p u +i' 
determined by the calculation to the fixed parameter, and tentatively 
determines the weight distribution of the column X(y\) (step S26). The 
5 weight y, is an integer of yi>2, and X(y,) indicates a portion of the weight 
Yi in the column. The parity check matrix creation unit 10 also deletes 
the weight in which the number of column is not more than 1 (X(y\)< yi/w t , 
i is a positive integer) from candidates. However, w t indicates the total 
number of 1 included in AG(2,2 S ). 
10 [0038] 

The parity check matrix creation unit 10 then selects a set of a 
weight candidate of the column {yi, y 2 , ... yi (yi<2 s )} which satisfies the 
weight distribution determined above and the following equation (4) 
(step S27). When the weight of the column y, which does not satisfy 
15 the following equation (4), is present, it is deleted from the candidates. 
[0039] 
[Formula 3] 

a i.i a i,2 A a u 1 



20 In equation 4, "a" indicates the coefficient which becomes a 

non-negative integer to {y 1p y 2> ... yi} for forming the weight of the 
column 2 s , i and j are positive integers, yi indicates the weight of the 
column, and yi indicates the maximum weight of the column. 
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[0041] 

The parity check matrix creation unit 10 then uses the 
optimization of Gaussian approximation, sets u, u+1, p u \ p u +i', and {yi, 
y 2 , yi} determined above to the fixed parameter, and determines the 
5 weight distribution X{y{) and the weight distribution of the row p u (step 
S28). 

[0042] 

The parity check matrix creation unit 10 then adjusts the weight 
distribution of the column X(y\) and the weight distribution of the row p u 

10 before the division processing (step S29). Each weight distribution 
after the adjustment is set to a value close to the value determined by 
Gaussian approximation as much as possible. Fig. 5 depicts a final 
weight distribution of column A.(yi) and the final weight distribution of 
row p u . 

15 [0043] 

Finally, the parity check matrix creation unit 10 divides the row 
and the column in the finite affine geometry (step S30) and creates the 
parity check matrix H of nxk. In the division processing of the finite 
affine geometry code in the invention, the finite affine geometry code is 

20 not regularly divided, but the number of "1" is randomly extracted from 
each row or each column (see the specific example of random division 
described later). Any method can be used as the extraction 
processing as long as the randomness is held. 
[0044] 

25 Specifically, when the row number of "1" in the first row in 
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EG(2,2 5 ) is expressed as: B,(x)={1 32 114 136 149 223 260 382 402 
438 467 507 574 579 588 622 634 637 638 676 717 728 790 851 861 
879 947 954 971 977 979 998}; the number of "1" is randomly extracted 
from B^x) , and, for example the first row to the fourth row R m (n) in the 
5 matrix after the division become as follows: 

Ri(n)={1 114 574 637 851 879 977 979} 

R 2 (n)={32 136 402 467 588 728 861 971} 

R 3 (n)={149 260 382 438 579 638 717 998} 

R 4 (n)={223 507 622 634 676 790 947 954}. 
10 [0045] 

An example of the random division, i.e. the "division method 
using a Latin square matrix of a random sequence" is described in 
detail below. When the random division is performed, the random 
sequence is easily and deterministically created. The advantage of 
15 this method is that the transmission side and the reception side can 
create the same random sequence. The procedure of the division 
method is as follows. 

[0046] 

(1 ) The basic random sequence is prepared. At this point, the finite 
20 affine geometry AG(2,2 S ) is used, and the basic random sequence C(i) 
is prepared according to the equation (5) when P is set to a minimum 
prime number satisfying P>2 S . 
C(1)=1 

C(i+1)=G 0 xC(i) mod P (5) 
25 Where i=0, 1 , ... , P-2, and G 0 is a primitive element of Galois 
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field GF(P). The number larger than 2 s is deleted from C(i) so that a 
series length becomes 2 s , and C(i) after the deletion is set to the basic 
random sequence. 
[0047] 

5 (2) A skip interval S(j) for reading the basic random sequence C(i) at 
a constant interval is defined as: 

S(j)=j j=1,2, -,2 s (6) 
[0048] 

(3) A permutation pattern LBj(i) is prepared by: 
10 LBj(i)=((S(j)xi) mod P)+1 

j=1,2, -, 2 s 

i=1, 2, .... P-1 (7) 
The number larger than 2 s is deleted from LBj(i). 
[0049] 

15 (4) Ajth Latin square matrix L jp (i) defined by q columns and i rows is 
calculated by: 

L Jq (i)=LBj(((q+i-2) mod 2 S ) + 1) 
j=1, 2, -, 2 s 
i=1, 2, .... 2 s 

20 q=1,2, -,2 s (8) 

[0050] 

(5) The column and the row are divided according to the Latin square 
matrix L jp (i). In the division of the column, g 0 , gi, ... , g n -i is set to a 
column vector of the parity check matrix H, and g c '(k) is set to kth "1" in 
25 the column of g c (c=0, 1, n-1). A set of positions of "1" in g c is set 
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to G c (see equation (9)). 

Gc={gc'(k), k=1 , 2, 2 s } (9) 
For example, the row number of "1 " in the column of c=1 -st of AG(2, 2 3 ) 
becomes Gi={1 3 8 20 23 24 34 58}. When the c-th column vector is 
5 expressed by g c '(k), the c-th column vector can be expressed by: 

gc , (1)=((c-1)+1)mod(2 2s -1) 

g c , (2)=(gc , (1)+2)mod(2 2s -1) 

g c '(3)=(g c , (2)+5)mod(2 2s -1) 

gc'(4)=(gc'(3)+12)mod(2 2s -1) 
10 g c , (5)=(g c '(4)+3)mod(2 2s -1) 

g c , (6)=(gc , (5)+1)mod(2 2s -1) 

gc , (7)=(g c , (6)+10)mod(2 2s -1) 

gc , (8)=(g c , (7)+24)mod(2 2s -1 ) (10) 
[0051] 

15 At this point, each column g c of the parity check matrix H is 

divided into the new column g c , e based on a degree and the coefficient 
of the column satisfying the equation (4). g c , e '(r) is set to "1" of the r-th 
row in the new column g c , e (see equation (11)). 

G 0 ,.={go,. , (r) l r=1 I 2 l "-} (11) 

20 [0052] 

An edge which is divided according to the following equation 
(12) is selected by the Latin square matrix group. Where a t ,i, a t , 2 , ■-, 
a t j and y-i, y 2 , ... , yi are the coefficient and the degree which satisfy the 
equation (4) respectively, and t indicates the row number of a 

25 coefficient matrix. When the column number of the finite affine plane 
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divided by the equation of the tth row is set to n t and the maximum 

value of the row number of the coefficient matrix is set to t m , t can be 

expressed by the following equation (13). 

[0053] 

[Formula 4] 

g , ce(r) = g , o(L j , q (i)) 
j = c/2 s 

q = ((c-1)mod2 s ) + 1 ( 12 ) 

k m-1 

i = r + £ min(a tm , max( o, e - 1 - g a ln )) ■ y m 

[0054] 

[Formula 5] 

'1(1 ^c^) 
2(^+1 gc^n,+n 2 ) 

M (13) 

t m (5 1 n i+ 1^c^X n i) 

10 [0055] 

The division processing explained in items (1) to (4) is 
described below with a specific example. For example, the row 
number of "1" in the column of c=1-st of AG(2, 2 3 ) is defined as Gi 6 ={10 
16 18 23 35 38 39 49}. Fig. 6 depicts a division procedure performed 

15 by the Latin square matrix of the random sequence. When the 

procedure (5) is performed by the result of the Latin square matrix, "1" 
in the new column g 16 , e can be expressed by the following equation 
(14). 

gi6,i'(i)=gi6 , (L2,8(i))=gi6 , (3)=i8 
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gi6,i , (2)=gi6 , (L 2 ,8(2))=gi6 , (2)=16 
gi6,2 , (1)=gi6 , (L2, 8 (3))=gi6 , (8)=49 
gi6, 2 '(2)=gi6 , (L2,8(4))=gi6 , (7)=39 
gi6, 3 '(1 )=gi6 , (L2,8(5))=gi6 , (6)=38 
5 gi6,3'(2)=g 16 '(L 2 ,8(6))=g 16 '(1)=10 
gi6,4 , (1)=gi6 , (L2,8(7))=g 16 , (4)=23 

gi6,4'(2)=gi6'(L2,8(8))=gi6'(5)=35 (14) 
[0056] 

As a result, the 16th column is divided as follows: 
10 Gie,i={18 16} 

Gie,2={49 39} 
Gi6, 3 ={38 10} 
Gis,4={23 35} 
[0057] 

15 As described above, the deterministic, stable-characteristics 

check matrix H(nxk) for the "Irregular-LDPC code" can be created by 
performing the method of forming the "Irregular-LDPC code" based on 
the affine finite geometry (Fig. 2, step S1). 
[0058] 

20 After the parity check matrix H and the creation matrix G and 

G" 1 (G" 1 G=I: unit matrix) are created in the above manner, in the 
communication apparatus on the transmission side, a random number 
generation unit 11 generates the random number sequence (sequence 
of 1 and 0: transmission data) and randomly determines the 

25 transmission code (+: the code corresponding to the measuring 
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apparatus that can identify the light polarized in the horizontal direction 
from the light polarized in the vertical direction, x: the code 
corresponding to the measuring apparatus that can identify the light 
polarized in the oblique direction) (step S2). On the other hand, in the 
5 communication apparatus on the reception side, a random number 
generation unit 31 randomly determines a reception code (+: the code 
corresponding to the measuring apparatus that can identify the light 
polarized in the horizontal direction from the light polarized in the 
vertical direction, and x: the code corresponding to the measuring 
10 apparatus that can identify the light polarized in the oblique direction) 
(step S12). 

[0059] 

In the communication apparatus on the transmission side, a 
photon creation unit 12 transmits the photon in the polarized direction 

1 5 automatically determined by the combination of the random number 
sequence and the transmission code (step S3). For example, the light 
polarized in the horizontal direction by the combination of 0 and +, the 
light polarized in the vertical direction by the combination of 1 and +, 
the light polarized in the 45° direction by the combination of 0 and x, 

20 and the light polarized in the 135° direction by the combination of 1 and 
x are transmitted to the quantum communication path respectively 
(transmission signal). 
[0060] 

In the communication apparatus on the reception side, a photon 
25 receiving unit 32 that has received the light signal generated from the 
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photon creation unit 12 measures the light on the quantum 
communication channel (reception signal). The photon receiving unit 
32 obtains the reception data automatically determined by the 
combination of the reception code and the reception signal (step S13). 
5 In this case, 0 is obtained as the reception data by the combination of 
the light polarized in the horizontal direction and +, 1 is obtained as the 
reception data by the combination of the light polarized in the vertical 
direction and +, 0 is obtained as the reception data by the combination 
of the light polarized in the 45° direction and x, and 0 is obtained as the 
10 reception data by the combination of the light polarized in the 135° 
direction and x respectively. 
[0061] 

In the communication apparatus on the reception side, the 
random number generation unit 31 transmits the reception code to the 

15 communication apparatus on the transmission side through the public 
communication path in order to check whether the measurement has 
been performed with an appropriate measuring apparatus (step S13). 
When the communication apparatus on the transmission side receives 
the reception code, the communication apparatus on the transmission 

20 side checks whether the measurement has been performed with an 

appropriate measuring apparatus. The transmitter transmits the result 
to the communication apparatus on the reception side through the 
public communication path (step S3). The communication apparatus 
on the reception side and the communication apparatus on the 

25 transmission side save only the data corresponding to the reception 
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signal which has received with the appropriate measuring apparatus 
and discard other pieces of the reception data (step S3 and step S13). 
The saved data is then stored in the memory or the like, and the n bits 
of the data are sequentially read out from the front end of the data to 
5 create transmission data itia and reception data iris (ma is rriA which is 
affected by the noise and the like on the transmission path). Namely, 
the next n bits are read out after each completion of the common key 
creation processing, and the transmission data itia and the reception 
data m B are created in each case. In this embodiment, the position of 
10 the bit corresponding to the reception signal received by the 
appropriate measuring apparatus can be shared between the 
communication apparatus on the transmission side and the 
communication apparatus on the reception side. 
[0062] 

15 In the communication apparatus on the transmission side, a 

syndrome creation unit 14 calculates syndrome S A =HmA of m A by the 
parity check matrix H(nxk) and the transmission data m A and notifies a 
public communication path communication unit 13 and the 
communication apparatus on the reception side of the result through 

20 the public communication path (step S4). At this step, there is a 
possibility that the syndrome S A of mA (information of k bits) is known 
by the interceptor. On the other hand, in the communication apparatus 
on the reception side, public communication path communication unit 
34 receives the syndrome S A of m A and notifies a syndrome decoding 

25 unit 33 of the syndrome Sa of m A (step S14). 
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[0063] 

The syndrome decoding unit 33 calculates syndrome SB=Hms of 
m B by the parity check matrix H and the transmission data m B and 
further calculates syndrome S=Sa+Sb by the syndrome Sa of itia and 
5 the syndrome Sb of ms (step S1 5). The syndrome decoding unit 33 
estimates transmission data m A based on the syndrome S (step S16). 
At this point, it is assumed that m A = rriA+e (noise and the like) and the 
syndromes is deformed as shown in the equation (15). "e" is 
accordingly obtained by syndrome decoding, and the transmission data 
10 mA is obtained (step S1 6). "+" of S=Sa+S b and iriA+e indicates 
exclusive OR. 

S=S A +S B 
=Hm A +Hm B 
=H(m A +m B ) 
15 =H(m A +m A +e) 

=He (15) 
[0064] 

Finally, In the communication apparatus on the reception side, a 
common key creation unit 35 discards a part of pieces of the common 

20 information (m A ) according to the public error correction information 
(the information of k bits having a possibility of the intercept: Sa) and 
creates the cryptographic key r including the amount of information of 
n-k bits (step S17). Namely, the common key creation unit 35 creates 
the cryptographic key r from the following equation (16) by the 

25 G" 1 (nx(n-k)) which is calculated in advance. The communication 
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apparatus on the reception side shares the cryptographic key r with the 
communication apparatus on the transmission side. 

r=G" 1 m A (16) 

[0065] 

5 On the other hand, in the communication apparatus on the 

transmission side, a common key creation unit 15 discards a part of 
pieces of the common information (nia) according to the public error 
correction information (the information of k bits having a possibility of 
the intercept: S A ) and creates the cryptographic key r including the 

10 amount of information of n-k bits (step S5). Namely, the common key 
creation unit 1 5 creates the cryptographic key r from the following 
equation (16) by the G" 1 (nx(n-k)) which is calculated in advance (step 
S5). The communication apparatus on the transmission side shares 
the cryptographic key r with the communication apparatus on the 

15 reception side. 

[0066] 

As described above, in this embodiment, the data error of the 
common information is corrected by the deterministic, 
stable-characteristics parity check matrix H(nxk) for the "Irregular-LDPC 

20 code" and a part of pieces of the common information is discarded 
according to the public error correction information. Accordingly, the 
huge number of exchanges of the parity for specifying and correcting 
the error bit is avoided and error correction control is performed only by 
transmitting the error correction information, so that the time for the 

25 error correction processing is considerably reduced. Further, since a 
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part of pieces of the common information is discarded according to the 
public error correction information, the highly-secured common key can 
be created. 

[0067] 

5 In this embodiment, the inverse matrix G" 1 (nx(n-k)) which 

becomes G" 1 G=I (unit matrix) is created from the creation matrix 
G(nx(n-k)) satisfying HG=0, a part (k) of pieces of the common 
information (n) is discarded by the inverse matrix G"\ and the 
cryptographic key r including the amount of information of n-k bits. 

10 However, the invention is not limited to the embodiment, and a part of 
pieces of the common information (n) may be discarded and the 
cryptographic key r including the amount of information of m bits 
(m<n-k). Specifically, a mapping F(-) which maps an n-dimensional 
vector to an m-dimensional vector is assumed. In order to secure the 

15 common key, it is necessary that F( ) satisfies the condition that "the 
number of elements of a reverse image (F-G)" 1 (v) in a composition 
mapping F G of the mapping F and the creation matrix G is independent 
of an arbitrary m-dimensional vector v and is constant(2 n " k " m )." At this 
point, the cryptographic key r becomes r=F(m A ). 

20 [0068] 

Second Embodiment 

In the second embodiment, confidentiality of the cryptographic 
key r according to the first embodiment is further enhanced. 
[0069] 

25 Fig. 7 depicts a configuration of the quantum cryptosystem 
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according to the second embodiment of the invention. Like parts of 
the configuration as the first embodiment are designated by like 
reference numerals, and the description of like constituents is omitted. 
In order to enhance the confidentiality against the information 
5 intercepted on the quantum communication path, it is necessary that 
the information of the bits intercepted is compressed by a hash function. 
However, the hash function has some positions where interceptions can 
be easily made, depending on characteristics of the hash function. 
Therefore, this embodiment deals with intercepts of the hash function 
10 by randomly rearranging the position. 
[0070] 

Fig. 8 is a flowchart of the quantum key distribution of the 
second embodiment, particularly depicts the processing of the 
communication apparatus on the transmission side. In the 

15 communication apparatus on the transmission side, a random 

permutation unit 16 creates a nonsingular random matrix R((n-k)x(n-k)), 
notifies the common key creation unit 15 of R, and further notifies the 
common key creation unit 35 in the communication on the transmission 
side of R through the public communication path (step S6). In Figs. 7 

20 and 8, although the random matrix is created and transmitted in the 
communication apparatus on the transmission side, as an example, it is 
also possible that the processing is performed in the communication 
apparatus on the reception side. 
[0071] 

25 In the communication apparatus on the transmission side, the 
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common key creation unit 15 discards a part of pieces of the common 
information (m A ) according to the public error correction information 
(the information of k bits having a possibility of the intercept: Sa), 
enhances the confidentiality by the received random matrix R, and 
5 creates the cryptographic key r including the amount of information of 
n-k bits (step S5). Namely, the common key creation unit 15 creates 
the cryptographic key r from the following equation (17) by the received 
random matrix R((n-k)x(n-k)) and the G" 1 (nx(n-k)) which is calculated in 
advance (step S5). The communication apparatus on the transmission 
10 side shares the cryptographic key r with the communication apparatus 
on the reception side. 

r=RG" 1 m A (17) 

[0072] 

On the other hand, in the communication apparatus on the 
15 reception side, the common key creation unit 35 also discards a part of 
pieces of the common information (m A ) according to the public error 
correction information (the information of k bits having a possibility of 
the intercept: Sa), enhances the confidentiality by the received random 
matrix R, and creates the cryptographic key r including the amount of 
20 information of n-k bits (step S17). Namely, the common key creation 
unit 15 creates the cryptographic key r from the following equation (17) 
by the received random matrix R((n-k)x(n-k)) and the G" 1 (nx(n-k)) which 
is calculated in advance (step S17). The communication apparatus on 
the reception side sets the cryptographic key r to the common key 
25 which is shared with the communication apparatus on the transmission 
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side. 

[0073] 

As described above, in this embodiment, the data error of the 
common information is corrected by the deterministic, 
5 stable-characteristics parity check matrix H(nxk) for the "Irregular-LDPC 
code," a part of pieces of the common information is discarded 
according to the public error correction information, and the common 
information is rearranged by the nonsingular random matrix. 
Therefore, the huge number of exchanges of the parity for specifying 

10 and correcting the error bit is avoided and error correction control is 
performed only by transmitting the error correction information, so that 
the time for the error correction processing is considerably reduced. 
Since a part of pieces of the common information is discarded 
according to the public error correction information, the highly-secured 

15 common key can be created. Further, since the common information 
is rearranged by the nonsingular random matrix, the confidentiality can 
be enhanced. 
[0074] 

In this embodiment, similarly to the first embodiment, it is also 
20 possible that a part of pieces of the common information (n) is 
discarded and the cryptographic key r including the amount of 
information of m bits (m<n-k). In this case, the common key becomes 
r=RF(m A ). 

[0075] 
25 Third Embodiment 
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In the first embodiment, a part of pieces of the common 
information is discarded by the inverse matrix G" 1 of the creation matrix 
G. On the contrary, in the third embodiment, a part of pieces of the 
common information is discarded without using the inverse matrix G" 1 of 
5 the creation matrix by the characteristics of the parity check matrix H. 
The configuration of this embodiment is similar to the first embodiment 
shown in Fig. 1. 

[0076] 

The quantum key distribution according to the third embodiment 
10 is described below. Only the processing different from the processing 
in Fig. 2 is described. 
[0077] 

In the communication apparatus on the transmission side and 
the communication apparatus on the reception side, the parity check 

15 matrix creation units 10 and 30 determine the parity check matrix 

H(nxk) of the specific linear code (step S1 and step S11). The method 
of forming the "Irregular-LDPC code" based on the affine finite 
geometry (Details of step S1 in Fig. 2) is similar to the first embodiment 
shown in Fig. 3. 

20 [0078] 

After step S2 to step S4 are performed in the same procedure 
as the first embodiment, in the communication apparatus on the 
reception side, the common key creation unit 35 discards a part of 
pieces of the common information (m A ) according to the public error 

25 correction information (the information of k bits having a possibility of 
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the intercept: S A ) and creates the cryptographic key r including the 
amount of information of n-k bits (step S17). Specifically, the common 
key creation unit 35 performs the random permutation to the column of 
the parity check matrix created in step S11 . The common key creation 
5 unit 35 then exchanges the information concerning the bit discarded 
with the communication apparatus on the transmission side through the 
public communication path. In this case, the common key creation unit 
35 selects the specific "1" from the first column of the original finite 
affine geometry AG(2, 2 s ) and exchanges the position of "1" with the 
10 communication apparatus on the transmission side through the public 
communication path. 
[0079] 

The common key creation unit 35 then specifies the position 
after the division corresponding to the "1" and the position after the 

15 division corresponding to the "1" in each cyclically-shifted column from 
the parity check matrix after the random permutation, discards the bit in 
the common information itia corresponding to the specified positions, 
and makes the saved data the cryptographic key r. The 
communication apparatus on the reception side sets the cryptographic 

20 key r to the common key which is shared with the communication 
apparatus on the transmission side. 
[0080] 

On the other hand, in the communication apparatus on the 
transmission side, the common key creation unit 15 discards a part of 
25 pieces of the common information (m A ) according to the public error 
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correction information (the information of k bits having a possibility of 
the intercept: S A ) and creates the cryptographic key r including the 
amount of information of n-k bits (step S5). Specifically, the common 
key creation unit 15 performs the similar random permutation to the 
5 column of the parity check matrix created in step S1 . The common 
key creation unit 15 then exchanges the information concerning the bit 
discarded with the communication apparatus on the reception side 
through the public communication path. 
[0081] 

10 The common key creation unit 15 then specifies the position 

after the division corresponding to the "1" and the position after the 
division corresponding to the "1" in each cyclically-shifted column from 
the parity check matrix after the random permutation, discards the bit in 
the common information itu corresponding to the specified positions, 

15 and makes the saved data the cryptographic key r. The 
communication apparatus on the transmission side sets the 
cryptographic key r to the common key which is shared with the 
communication apparatus on the reception side. 
[0082] 

20 As described above, in the third embodiment, a part of pieces of 

the common information is discarded without using the inverse matrix 
G" 1 of the creation matrix by the characteristics of the parity check 
matrix H. Accordingly, the same advantage as the first embodiment 
can be obtained, and the complicated creation matrix G and the 

25 complicated inverse matrix G" 1 can be deleted. 
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[0083] 

In this embodiment, it is also possible that a part of pieces of 
the common information is discarded by the characteristics of the parity 
check matrix H and, similarly to the second embodiment, the common 
5 information is rearranged by the nonsingular random matrix. 
Therefore, the confidentiality can be enhanced. 
[0084] 

[Effects due to the Invention] 

As described above, according to the present invention, the 

10 data error of the common information is corrected by the deterministic, 
stable-characteristics parity check matrix H(nxk) for the "Irregular-LDPC 
code" and a part of pieces of the common information is discarded 
according to the public error correction information. Accordingly, the 
present invention has the advantage that the huge number of 

15 exchanges of the parity for specifying and correcting the error bit is 
avoided and error correction control is performed only by transmitting 
the error correction information, so that the time for the error correction 
processing is considerably reduced. Further, the invention has the 
advantage that highly-secured common key can be created because a 

20 part of pieces of the common information is discarded according to the 
public error correction information. 
[Brief Description of the Drawings] 

[Fig. 1] Fig. 1 depicts a configuration of a quantum 
cryptosystem according to a first embodiment of the invention. 

25 [Fig. 2] Fig. 2 is a flowchart of a process procedure for the 
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quantum key distribution according to the first embodiment. 

[Fig. 3] Fig. 3 is a flowchart of forming "Irregular-LDPC code" 
based on finite affine geometry. 

[Fig. 4] Fig. 4 depicts a matrix of finite affine geometry code 
5 AG (2, 2 2 ). 

[Fig. 5] Fig. 5 depicts a final weight distribution of column X(y\) 
and a final weight distribution of row p u . 

[Fig. 6] Fig. 6 depicts a division procedure performed by a 
Latin square matrix of a random sequence. 
10 [Fig. 7] Fig. 7 depicts a configuration of a quantum 

cryptosystem according to a second embodiment of the invention. 

[Fig. 8] Fig. 8 is a flowchart of a quantum key distribution of 
the second embodiment of the invention. 

[Fig. 9] Fig. 9 is an overview of a conventional quantum key 
15 distribution. 

[Description of Signs] 

1, 1a, 3 cryptographic key creation unit, 2, 4 communication unit, 
10, 30 parity check matrix creation unit, 11, 31 random number 
generation unit, 12 photon creation unit, 13, 34 public communication 
20 path communication unit, 14 syndrome creation unit, 15, 35 common 
key creation unit, 21, 42 encryption unit, 22, 41 transmission and 
receiving unit, 32 photon receiving unit, 33 syndrome decoding unit. 
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[Type of Document] Abstract 
[Abstract] 

[Object] To provide a quantum key distribution method that can create 
a highly-secured common key while correcting data error on a 
5 transmission path by an error correction code having remarkably high 
characteristics. 

[Means] In a quantum key distribution method of the invention, at first 
a communication apparatus on a reception side corrects the data error 
of reception data by a deterministic, stable-characteristics parity check 
10 matrix for a "Irregular-LDPC code." The communication apparatus on 
the reception side and a communication apparatus on a transmission 
side discard a part of pieces of the common information according to 
public error correction information. 
[Selected Figure] Fig. 1 
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